Something different with elf64-x86-64 format?

[Ian Lance Taylor]

Etienne Lorrain <etienne_lorrain@yahoo.fr> writes:

> I find the correct header at 0, and at offset 0x20 I see
> e_phoff: "Program header offset" so I get the program header
> at 0x40.
> At 0x40, I have p_type "Type of segment" i.e. PT_LOAD,
> at 0x44 I have p_flags "Segment attributes" 0x05 (RX),
> but at 0x48 I should have a 64 bits number p_offset
>  "Offset in file" and it is zero... unlike what objdump tells.

objdump is dumping the section headers.  You are looking at the segment
headers.

When examining ELF files at this level of detail, you should always use
readelf, not objdump.  objdump translates from ELF into a generic
format, and then dumps the generic format.  readelf dumps the ELF file
directly.  In this case, you want to look at the output of readelf -l.

Ian